External data processing device to interface with an ambulatory repeater and method thereof

ABSTRACT

An external data processing device to interface with an ambulatory repeater and method thereof is presented. An external data processing device is interfaced in far field telemetric communication with an ambulatory repeater. The external data processing device receives sensitive information preencrypted prior to implant under a cryptographic key uniquely assigned to an implantable medical device over a secure connection from the ambulatory repeater. Physiological measures retrieved from the implantable medical device by the ambulatory repeater are received by the external data processing device over a non-secure connection.

CROSS-REFERENCE TO RELATED APPLICATION

This patent application is a continuation of U.S. patent applicationSer. No. 11/113,206, filed Apr. 22, 2005, pending, the priority filingdate of which is claimed, and the disclosure of which is incorporated byreference.

FIELD OF THE INVENTION

The present invention relates in general to external data processingdevices and, specifically, to an external data processing device tointerface with an ambulatory repeater and method thereof.

BACKGROUND OF THE INVENTION

In general, implantable medical devices (IMDs) provide in situ therapydelivery, such as pacing, cardiac resynchronization, defibrillation,neural stimulation and drug delivery, and physiological monitoring anddata collection. Once implanted, IMDs function autonomously by relyingon preprogrammed operation and control over therapeutic and monitoringfunctions. IMDs can be interfaced to external devices, such asprogrammers, repeaters and similar devices, which can program,troubleshoot, and download telemetered data, typically through inductionor similar forms of near-field telemetry.

Telemetered data download typically occurs during follow-up, whichrequires an in-clinic visit by the patient once every three to twelvemonths, or as necessary. Following interrogation of the IMD, thetelemetered data can be analyzed to evaluate patient health status.Although clinical follow-up is mandatory, the frequency and type offollow-up are dependent upon several factors, including projectedbattery life, type, mode and programming of IMD, stability of pacing andsensing, the need for programming changes, underlying rhythm or cardiaccondition, travel logistics, and the availability of alternativefollow-up methods, such as transtelephonic monitoring, for example, theCareLink Monitor, offered by Medtronic, Inc., Minneapolis, Minn.;Housecall Plus Remote Patient Monitoring System, offered by St. JudeMedical, Inc., St. Paul, Minn.; and BIOTRONIK Home Monitoring Service,offered by BIOTRONIK GmbH & Co. KG, Berlin, Germany.

Telemetered data generally includes information on all programmed deviceparameters, as well as real time or measured and recorded data on theoperation of the IMD available at the time of interrogation. Inaddition, telemetered data can include parametric and physiologicalinformation on the output circuit, battery parameters, sensor activitiesfor rate adaptive IMDs, event markers, cumulative totals of sensed andpaced events, and transmission of electrograms. Derived measures includebattery depletion, which can be gauged by the downloaded battery voltageand impedance levels, and lead integrity, which is reflected by pacingimpedance. Event markers depict pacing and sensing simultaneouslyrecorded with electrograms to indicate how the IMD interpretsspecifically paced or sensed events with timing intervals. Other typesof telemetered data are possible.

Clinical follow-up is conventionally performed using a programmer underthe direction of trained healthcare professionals. The programmer istypically interfaced to an IMD through inductive near field telemetry.Fundamentally, IMDs are passive devices that report on operational andbehavioral patient status, including the occurrence of significantevents, only when interrogated by an external device. As a result, theprogrammer-based follow-up sessions generally provide the soleopportunity for the IMD to report any significant event occurrencesobserved since the last follow-up session. Moreover, the latency inreporting significant event occurrences becomes dependent upon thetiming of the clinical follow-up sessions for non-closely followedpatients. Thus, in some circumstances, delays in downloading telemetereddata can result in lost data or chronic cardiac conditions recognizedtoo late.

Recently, far field telemetry using radio frequency (RF) carrier signalshas provided an alternative means for interfacing programmers andsimilar external devices to IMDs, such as described in commonly-assignedU.S. Pat. No. 6,456,256, issued Sep. 24, 2002, to Amudson et al.; U.S.Pat. No. 6,574,510, to Von Arx et al., issued Jun. 3, 2003; and U.S.Pat. No. 6,614,406, issued Sep. 2, 2003, to Amudson et al., disclosuresof which are incorporated by reference. Far field telemetry has a higherdata rate, which results in shorter downloading times, and the patientexperiences greater freedom of movement while the IMD is being accessed.Nevertheless, despite the higher data rate, the IMD remains a passivedevice that only reports significant event occurrences when interrogatedusing an RF-capable programmer.

Similarly, dedicated monitoring devices, known as repeaters, have becomeavailable to patients to provide monitoring and IMD follow-up in anat-home setting similar to transtelephonic monitoring. Each repeater isspecifically matched to an IMD. Once a day or as required, the patientuses the repeater to actively poll the IMD through induction or farfield telemetry. Alternatively, some repeaters can be passively polled.During each session, any significant events occurrences are reported,although programming of the IMD is generally not allowed for safetyreasons. As well, repeaters download recorded telemetered data. Despitethe improved frequency and speed of telemetered data downloads, thelatency to report significant event occurrences can be as long as a fullday. The patient must also be physically proximal to the repeater duringinterrogation in the same fashion as a programmer. In addition,repeaters, by virtue of being stationary devices, are unable to capturepatient physiological and behavioral data while the patient is engagedin normal everyday activities or at any other time upon the initiationof the patient or by a remote patient management system.

Furthermore, the use of RF telemetry in IMDs potentially raises seriousprivacy and safety concerns. Sensitive information, such aspatient-identifiable health information (PHI), exchanged between an IMDand the programmer or repeater should be safeguarded to protect againstcompromise. Recently enacted medical information privacy laws, includingthe Health Insurance Portability and Accountability Act (HIPAA) and theEuropean Privacy Directive underscore the importance of safeguarding apatient's privacy and safety and require the protection of allpatient-identifiable health information (PHI). Under HIPAA, PHI isdefined as individually identifiable health information, includingidentifiable demographic and other information relating to the past,present or future physical or mental health or condition of anindividual, or the provision or payment of health care to an individualthat is created or received by a health care provider, health plan,employer or health care clearinghouse. Other types of sensitiveinformation in addition to or in lieu of PHI could also be protectable.

The sweeping scope of medical information privacy laws, such as HIPAA,may affect patient privacy on IMDs with longer transmission ranges, suchas provided through RF telemetry, and other unsecured data interfacesproviding sensitive information exchange under conditions that couldallow eavesdropping, interception or interference. Sensitive informationshould be encrypted prior to long range transmission. Currentlyavailable data authentication techniques for IMDs can satisfactorilysafeguard sensitive information. These techniques generally requirecryptographic keys, which are needed by both a sender and recipient torespectively encrypt and decrypt sensitive information transmittedduring a data exchange session. Cryptographic keys can be used toauthenticate commands, check data integrity and, optionally, encryptsensitive information, including any PHI, during a data exchangesession. Preferably, the cryptographic key is unique to each IMD.However, authentication can only provide adequate patient data securityif the identification of the cryptographic key from the IMD to theprogrammer or repeater is also properly safeguarded.

Therefore, there is a need for an approach to providing an ambulatorysolution to retrieving physiological and parametric telemetered datafrom IMDs. Preferably, such an approach would provide authenticated andsecure communication with IMDs and include configurable activationsettings.

SUMMARY OF THE INVENTION

One embodiment provides a system and method for providing an externaldata processing device to interface with an ambulatory repeater. Theexternal data processing device is interfaced in far field telemetriccommunication with an ambulatory repeater. The external data processingdevice receives sensitive information preencrypted prior to implantunder a cryptographic key uniquely assigned to an implantable medicaldevice over a secure connection from the ambulatory repeater.Physiological measures retrieved from the implantable medical device bythe ambulatory repeater are received by the external data processingdevice over a non-secure connection.

A further embodiment provides an ambulatory repeater for use inautomated patient care and method thereof. A sensor directly monitors apatient and records physiological measures on an ad hoc basis. Thesensor interfaces with an implantable medical device and periodicallyretrieves physiological measures from the implantable medical device.Sensitive information is preencrypted and stored on the implantablemedical device prior to implant under a cryptographic key uniquelyassigned to the implantable medical device. The ambulatory repeaterretrieves the cryptographic key and authorization to access thesensitive information and physiological measures on the implantablemedical device is authenticated from an external data processing device.The ambulatory repeater is interfaced to the implantable medical deviceby wireless telemetry and to the external data processing device throughwireless communication. The ambulatory repeater exchanges the sensitiveinformation and physiological measures with the external data processingdevice.

Still other embodiments of the present invention will become readilyapparent to those skilled in the art from the following detaileddescription, wherein are described embodiments of the invention by wayof illustrating the best mode contemplated for carrying out theinvention. As will be realized, the invention is capable of other anddifferent embodiments and its several details are capable ofmodifications in various obvious respects, all without departing fromthe spirit and the scope of the present invention. Accordingly, thedrawings and detailed description are to be regarded as illustrative innature and not as restrictive.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram showing, by way of example, an implantablemedical device.

FIG. 2 is a process flow diagram showing interfacing with theimplantable medical device of FIG. 2 using an ambulatory repeater.

FIG. 3 is a functional block diagram showing, by way of example, anambulatory repeater in handheld form factor, in accordance with oneembodiment.

FIG. 4 is a functional block diagram showing, by way of example, anambulatory repeater in wearable form factor, in accordance with afurther embodiment.

FIG. 5 is a functional block diagram showing, by way of example, systemsfor securely communicating using an ambulatory repeater, in accordancewith one embodiment.

FIG. 6 is a functional block diagram showing, by way of example, theinternal components of the ambulatory repeater in the wearable formfactor of FIG. 4.

FIG. 7 is a flow diagram showing a method for providing automatedpatient care using an ambulatory repeater, in accordance with oneembodiment.

FIG. 8 is a flow diagram showing a routine for obtaining a cryptographickey for use in the method of FIG. 7.

FIG. 9 is a flow diagram showing a routine for activating an ambulatoryrepeater for use in the method of FIG. 7.

FIG. 10 is a flow diagram showing a routine for performing a secure dataexchange for use in the method of FIG. 7.

FIG. 11 is a flow diagram showing a routine for interrogating an IMD foruse in the method of FIG. 7.

DETAILED DESCRIPTION

Implantable Medical Device

FIG. 1 is a block diagram showing, by way of example, an implantablemedical device (IMD) 103. The IMD 103, such as a pacemaker, implantablecardiac defibrillator (ICD) or similar device, is surgically implantedin the chest or abdomen of a patient to provide in situ therapy, such aspacing, cardiac resynchronization, defibrillation, neural stimulationand drug delivery, and physiological data monitoring. Examples ofcardiac pacemakers suitable for use in the described embodiment includethe Pulsar Max II, Discovery, and Discovery II pacing systems and theContak Renewal cardiac resynchronization therapy defibrillator, sold byGuidant Corporation, St. Paul, Minn.

The IMD 103 includes a case 104 and terminal block 105 coupled to a setof leads 106 a-b. The leads 106 a-b are implanted transvenously forendocardial placement. The IMD 103 is in direct electrical communicationwith the heart 102 through electrodes 111 a-b positioned on the distaltips of each lead 106 a-b. By way of example, the set of leads 106 a-bcan include a right ventricular electrode 111 a, preferably placed inthe right ventricular apex 112 of the heart 102, and a right atrialelectrode 111 b, preferably placed in the right atrial chamber 113 ofthe heart 102. The set of leads 106 a-b can also include a rightventricular electrode 114 a and a right atrial electrode 114 b to enablethe IMD 103 to directly collect physiological measures, preferablythrough millivolt measurements.

The IMD 103 includes a case 104 and terminal block 105 coupled to a setof leads 106 a-b. The IMD case 104 houses hermitically-sealedcomponents, including a battery 107, control circuitry 108, memory 109,and telemetry circuitry 110. The battery 107 provides a finite, powersource. The control circuitry 108 controls therapy delivery andmonitoring, including the delivery of electrical impulses to the heart102 and sensing of spontaneous electrical activity. The memory 109includes a memory store in which the physiological signals sensed by thecontrol circuitry 108 can be temporarily stored, pending telemetereddata download.

The telemetry circuitry 110 provides an interface between the IMD 103and an external device, such as a programmer conventional or ambulatoryrepeater, or similar device. For near field data exchange, the IMD 103communicates with a programmer or conventional or ambulatory repeater(not shown) through inductive telemetry signals exchanged through a wandplaced over the location of the IMD 103. Programming or interrogatinginstructions are sent to the IMD 103 and the stored physiologicalsignals are downloaded into the programmer or repeater. For far fielddata exchange, the IMD 103 communicates with an external device capableof far field telemetry, such as a radio frequency (RF) programmer,conventional or ambulatory repeater, or other wireless computing device,as further described below with reference to FIG. 2. Other types of datainterfaces are possible, as would be appreciated by one skilled in theart.

Other configurations and arrangements of leads and electrodes can alsobe used. Furthermore, although described with reference to IMDs forproviding cardiac monitoring and therapy delivery, suitable IMDs alsoinclude other types of implantable therapeutic and monitoring devices inaddition to or in lieu of cardiac monitoring and therapy delivery IMDs,including IMDs for providing neural stimulation, drug delivery, andphysiological monitoring and collection.

Process Flow

FIG. 2 is a process flow diagram 120 showing interfacing with the IMD103 of FIG. 2 using an ambulatory repeater 123. The ambulatory repeater123 provides a portable means for securely transacting a data exchangesession with the IMD 103 and, in turn, at least one of a conventional or“base” repeater 124, server 125, or programmer 126, as further describedbelow with reference to FIG. 5. Unlike a base repeater 124, theambulatory repeater 123 can collect patient health information asfrequently or infrequently as needed and, due to being immediatelyproximate to the patient, can measure the activity level of the patientduring normal everyday activities, rather than only at home or in aclinical setting.

Interfacing 120 with the IMD 103 includes key generation 121,authentication 129, activation 130, protected data storage and retrieval131, unprotected data storage and retrieval 136, and optional dataexchanges 132, 133, 134 with the base repeater 124, server 125, andprogrammer 126. Key generation 121 creates a cryptographic key 122,which is used to encrypt and decrypt any sensitive information exchangedwith the IMD 103, such as during protected data storage and retrieval131 using long range telemetry or over any other unsecured interface.The cryptographic key 122 can be statically generated and persistentlystored, dynamically generated and persistently stored, dynamicallygenerated and non-persistently stored as a session cryptographic key122, or a combination of the foregoing. Persistently-storedcryptographic keys 122 are maintained in a fixed secure key repository,such as a programmer, patient designator, secure database, token, baserepeater 124, ambulatory repeater 123, and on the IMD 103 itself.Statically generated and persistently-stored cryptographic keys arestored in the IMD 103 prior to implantation, such as during themanufacturing process. Dynamically generated and persistently-storedcryptographic keys are generated dynamically, such as by the ambulatoryrepeater 123 for subsequent download to the IMD 103 using short rangetelemetry following implantation. Dynamically generated andnon-persistently-stored session cryptographic keys are also generateddynamically and shared with the IMD 103, but are not persistently storedand are used for a single patient data exchange. Each cryptographic key122 is uniquely assigned to the IMD 103. In one embodiment, thecryptographic key 103 has a length of 128 bits, is symmetric or is both128-bits long and symmetric. Other cryptographic key lengths andsymmetries are possible.

Authentication 129 provides an opportunity to securely obtain thecryptographic key 122 uniquely assigned to the IMD 103. In oneembodiment, the IMD 103 interfaces with an external source, such as theambulatory repeater 123 or other wireless computing device, to eitherreceive or share the cryptographic key 122 assigned to the IMD 103, suchas described in commonly-assigned U.S. patent application Ser. No.10/800,806, filed Mar. 15, 2004, pending, the disclosure of which isincorporated by reference. In a further embodiment, the ambulatoryrepeater 123 retrieves the cryptographic key 122 from the IMD 103 usingsecure, short range telemetry, such as inductive telemetry, as furtherdescribed below with reference to FIG. 5.

In a further embodiment, the cryptographic key 122 is entrusted to athird party, such as hospital or emergency services, as a form of keyescrow. Under normal circumstances, the cryptographic key 122 will notbe released unless the requestor performs proper authentication 129.However, the cryptographic key 122 could be released underspecifically-defined circumstances, such as a bona fide medicalemergency, to a third party to facilitate access to patient healthinformation in the IMD 103, ambulatory repeater 123, base repeater 124,server 125, programmer 126, or other such authenticated device.

Following authentication 126, the ambulatory repeater 123 can be used tosecurely transact data exchange sessions with the IMD 103. Each dataexchange session is secure in that the patient health information beingexchanged is safely protected from compromise and interception byencryption prior to being transmitted. Thus, the communication channelcan be unsecured, as the data itself remains protected. As theambulatory repeater 123 remains physically proximal to the patient,secure data exchange sessions are performed either as on demand or per aschedule, as further described below with reference to FIGS. 6 and 9.Briefly, activation 130 can occur due to a patient-initiatedinterrogation, on demand or at scheduled times. A patient-initiatedinterrogation is triggered by a manual overwrite of the ambulatoryrepeater 123 by the patient when the patient, for instance, feels ill,or otherwise inclined to take a reading of data values. On demandinterrogation occurs due to a remote or local event, such as remoteactivation request from the server 125. Scheduled interrogation isspecified by a healthcare provider and remains in effect until a newschedule is downloaded.

Upon activation 130, protected data storage and retrieval 131 andunprotected data storage and retrieval 136 are performed. Duringprotected data storage and retrieval 131, sensitive information 127(SI), particularly PHI, is provided to and retrieved from the IMD 103,as further described below. During unprotected data storage andretrieval 136, non-sensitive information (non-SI) 135 is retrieved fromand sent to the IMD 103 directly via the ambulatory repeater 123.Protected data storage and retrieval 131 and unprotected data storageand retrieval 136 can occur simultaneously during the same data exchangesession. In a further embodiment, the SI 127 provided to the IMD 103 caninclude programming instructions for the IMD 103.

In one embodiment, the bulk of the patient health information retrievedfrom the IMD 103 is non-SI 135. SI 127 is generally limited to onlypatient-identifiable health information, which typically does not changeon a regular basis. The non-SI 135 loosely falls into two categories ofdata. First, physiological data relates directly to the biological andbiochemical processes of the body, such as salinity, pulse, bloodpressure, glucose level, sweat, and so forth. Second, behavioral datarelates to physical activities performed by the patient either duringthe course of a normal day or in response to a specific request orexercise regimen, such as sitting, standing, lying supine, and so forth.Other types of patient health measures are possible.

During protected data storage and retrieval 131, SI 127, particularlyPHI, can be received into the ambulatory repeater 123 from one or moresensors 128 and from a patient or clinician, respectively via the baserepeater 124 and server 125 or programmer 126. Part or all of thesensitive information 127 is preferably preencrypted using thecryptographic key 122, including any PHI, which can be stored on the IMD103 as static data for retrieval by health care providers and for use bythe IMD 103, such as described in commonly-assigned U.S. patentapplication Ser. No. 10/801,150, filed Mar. 15, 2004, pending, thedisclosure of which is incorporated by reference. If the sensitiveinformation needs to be retrieved, the ambulatory repeater 123 obtainsthe cryptographic key 122, if necessary, through authentication 126 andretrieves the encrypted information 128 from the IMD 103 for subsequentdecryption using the cryptographic key 122. In one embodiment, thesensitive information 127, including any PHI, is encrypted using astandard encryption protocol, such as the Advanced Encryption Standardprotocol (AES). Other authentication and encryption techniques andprotocols, as well as other functions relating to the use of thecryptographic key 122 are possible, including the authentication andencryption techniques and protocols described in commonly-assigned U.S.Pat. No. 7,155,290, issued Dec. 26, 2006, the disclosure of which isincorporated by reference.

Ambulatory repeater-to-sensor data exchanges 139 enable the ambulatoryrepeater 123 to receive patient health information from the sensors 138,including external sensors, such as a weight scale, blood pressuremonitor, electrocardiograph, Holter monitor, or similar device. In afurther embodiment, one or more of the sensors 138 can be integrateddirectly into the ambulatory repeater 123, as further described belowwith reference to FIG. 6.

The non-SI 135 and SI 127 is exchanged with at least one of threeexternal data processing devices, which include the base repeater 124,server 125, and programmer 126. In addition, the ambulatory repeater 123is communicatively interfaced to at least one external sensor todirectly measure patient health information, as further described belowbeginning with reference to FIG. 5. Ambulatory repeater-to-base repeaterdata exchanges 132 enable the ambulatory repeater 123 to function as ahighly portable extension of the base repeater 124. Unlike the baserepeater 124, the ambulatory repeater 123 includes a power supply thatenables secure interfacing with the IMD 103 while the patient is mobileand away from the base repeater 124 and can interrogate the IMD 103 atany time regardless of the patient's activity level.

Ambulatory repeater-to-server data exchanges 133 enable the server 125to directly access the IMD 103 via the ambulatory repeater 123 throughremote activation, such as in emergency and non-emergency situations andin those situation, in which the base repeater 125 is otherwiseunavailable.

Ambulatory repeater-to-programmer data exchanges 134 supplement theinformation ordinarily obtained during a clinical follow-up sessionusing the programmer 126. The ambulatory repeater 123 interfaces to andsupplements the retrieved telemetered data with stored data values thatwere obtained by the ambulatory repeater 123 on a substantiallycontinuous basis.

In addition, patient health information can be shared directly 137between the base repeater 124, server 125, and programmer 126. Othertypes of external data processing devices are possible, includingpersonal computers and other ambulatory repeaters.

Ambulatory Repeater in Handheld Form Factor

FIG. 3 is a functional block diagram 150 showing, by way of example, anambulatory repeater 123 in handheld form factor 151, in accordance withone embodiment. The handheld form factor 151 enables the ambulatoryrepeater 123 to be carried by the patient and can be implemented aseither a stand-alone device or integrated into a microprocessor-equippeddevice, such as a personal data assistant, cellular telephone or pager.Other types of handheld form factors are possible.

The handheld form factor 151 includes a display 152 for graphicallydisplaying indications and information 157, a plurality ofpatient-operable controls 153, a speaker 154, and a microphone 155 forproviding an interactive user interface. The handheld form factor 151 ispreferably interfaced to the IMD 103 through RF telemetry and to thebase repeater 124, server 125, and programmer 126 through either RFtelemetry, cellular telephone connectivity or other forms of wirelesscommunications, as facilitated by antenna 156. The display 152 andspeaker 154 provide visual and audio indicators while the controls 153and microphone 155 enable patient feedback. In addition, one or moreexternal sensors (not shown) are interfaced or, in a further embodiment,intergraded into the handheld form factor 151 for directly monitoringpatient health information whenever required.

The types of indications and information 157 that can be provided to thepatient non-exclusively include:

(1) Health measurements

(2) Active or passive pulse generator or health information monitoring

(3) Data transmission in-process indication

(4) Alert condition detection

(5) Impending therapy

(6) Ambulatory repeater memory usage

(7) Ambulatory repeater battery charge

In addition to securely exchanging data with the IMD 103, the ambulatoryrepeater 123 can perform a level of analysis of the downloadedteletemered data and, in a further embodiment, provide a further visualindication 158 to the patient for informational purposes.

The handheld form factor 151 can also include a physical interface 159that allows the device to be physically connected or “docked” to anexternal data processing device, such as the base repeater 124, for highspeed non-wireless data exchange and to recharge the power supplyintegral to the handheld form factor 151. The ambulatory repeater 123can continue to securely communicate with the IMD 103, even when“docked”, to continue remote communication and collection of telemetereddata.

Ambulatory Repeater in Wearable Form Factor

FIG. 4 is a functional block diagram 170 showing, by way of example, anambulatory repeater 123 in wearable form factor 171, in accordance witha further embodiment. The wearable form factor 171 enables theambulatory repeater 123 to be worn by the patient and can be implementedas either a stand-alone device or integrated into amicroprocessor-equipped device, such as a watch or belt. Other types ofwearable form factors are possible.

Similar to the handheld form factor 151, the wearable form factor 171includes a display 172 for graphically displaying indications andinformation 177, a plurality of patient-operable controls 173, a speaker174, and a microphone 175 for providing an interactive user interface.The wearable form factor 171 is preferably interfaced to the IMD 103through RF telemetry and to the base repeater 124, server 125, andprogrammer 126 through either RF telemetry, cellular telephoneconnectivity or other forms of wireless communications, as facilitatedby antenna 176. The display 172 and speaker 174 provide visual and audioindicators while the controls 173 and microphone 175 enable patientfeedback. In addition, one or more external sensors (not shown) areinterfaced or, in a further embodiment, intergraded into the wearableform factor 171 for directly monitoring patient health informationwhenever required. The wearable form factor 171 also includes a physicalinterface 179 that allows the device to be physically connected or“docked” to an external data processing device.

Ambulatory Repeater System Overview

FIG. 5 is a functional block diagram 190 showing, by way of example,systems for securely communicating using an ambulatory repeater 123, inaccordance with one embodiment. By way of example, an ambulatoryrepeater 123 in a wearable form factor 171 is shown, although theambulatory repeater 123 could also be provided in the handheld formfactor 151. The ambulatory repeater 123 securely interfaces to the IMD103 over a secure data communication interface 191, such as describedabove with reference to FIG. 2. The ambulatory repeater interrogates theIMD 103 due to a patient-initiated interrogation, on demand, or atscheduled times. Patient-initiated interrogations are triggered by thepatient through a manual overwrite of the ambulatory repeater 123. Inone embodiment, the patient is limited in the number of times that apatient-initiated interrogation can be performed during a given timeperiod. However, in a further embodiment, a healthcare provider canoverride the limit on patient-initiated interrogations as required. Ondemand interrogations occur in response to a remote or local event, suchas a health-based event sensed by the ambulatory repeater 123. Scheduledinterrogations occur on a substantially regular basis, such as hourly orat any other healthcare provider-defined interval. The schedule isuploaded to the ambulatory repeater 123 and remains in effect untilspecifically replaced by a new schedule. The ambulatory repeater 123 canalso be activated by indirect patient action, such as removing thedevice from a “docking” station.

Once activated, parametric and behavioral data collected and recorded bythe IMD 103 from the external sensors are monitored by the ambulatoryrepeater 123 in a fashion similar to the base repeater 124. However, thepower supply enables the ambulatory repeater 123 to operate separatelyand independently from external power sources, thereby allowing thepatient to remain mobile. The ambulatory repeater 123 also provides thecollateral benefits of functioning as an automatic data back-uprepository for the base repeater 124 and alleviates patient fears of alack of monitoring when away from the base repeater 124. In a furtherembodiment, the parametric and behavioral data is gathered and analyzedby either the ambulatory repeater 123 or an external data processingdevice, such as repeater 124, server 125 or programmer 126, and providedfor review by a healthcare provider. Alternatively, the analysis can beperformed through automated means. A set of new IMD parameters can begenerated and provided to the ambulatory repeater 123 for subsequentreprogramming of the IMD 103.

Periodically or as required, the ambulatory repeater 123 interfaces toone or more of the base repeater 124, server 125, and programmer 126 toexchange data retrieved from the IMD 103. In one embodiment, theambulatory repeater 123 interfaces via a cellular network 191 or otherform of wireless communications. The base repeater 124 is a dedicatedmonitoring device specifically matched to the IMD 103. The base repeater124 relies on external power source and can interface to the IMD 103either through inductive or RF telemetry. The base repeater 124 furtherinterfaces to the ambulatory repeater 123 either through a physical orwireless connection, as further described above.

The server 125 maintains a database 192 for storing patient records. Thepatient records can include physiological quantitative and quality oflife qualitative measures for an individual patient collected andprocessed in conjunction with, by way of example, an implantable medicaldevice, such a pacemaker, implantable cardiac defibrillator (ICD) orsimilar device; a sensor 138, such as a weight scale, blood pressuremonitor, electrocardiograph, Holter monitor or similar device; orthrough conventional medical testing and evaluation. In addition, thestored physiological and quality of life measures can be evaluated andmatched by the server 123 against one or more medical conditions, suchas described in related, commonly-owned U.S. Pat. No. 6,336,903, toBardy, issued Jan. 8, 2002; U.S. Pat. No. 6,368,284, to Bardy, issuedApr. 9, 2002; U.S. Pat. No. 6,398,728, to Bardy, issued Jun. 2, 2002;U.S. Pat. No. 6,411,840, to Bardy, issued Jun. 25, 2002; and U.S. Pat.No. 6,440,066, to Bardy, issued Aug. 27, 2002, the disclosures of whichare incorporated by reference.

The programmer 126 provides conventional clinical follow-up of the IMD103 under the direction of trained healthcare professionals. In oneembodiment, the ambulatory repeater 123 interfaces via a cellularnetwork 191 or other form of wireless communications. Other types ofexternal data processing devices and interfacing means are possible.

In a further embodiment, the ambulatory repeater 123 interfaces toemergency services 193, which posses a copy of the cryptographic key 122(shown in FIG. 2) held in a key escrow. Under ordinary circumstances,patient health information is exchanged exclusively between theambulatory repeater 123 and authenticated external data processingdevices, such as the base repeater 124, server 125, and programmer 126.However, in a bona fide emergency situation, the emergency services 193can use the cryptographic key 122 to access the patient healthinformation in the ambulatory repeater 123 and IMD 103, as well as therepeater 124, server 125, and programmer 126. Other forms of key escroware possible.

Ambulatory Repeater Internal Components

FIG. 6 is a functional block diagram 190 showing, by way of example, theinternal components of the ambulatory repeater 123 in the wearable formfactor 171 of FIG. 4. By way of example, the ambulatory repeater 123includes a processor 202, memory 203, authentication module 212,communications module 205, physical interface 213, optional integratedsensor 214, and alarm 215. Each of the components is powered by a powersupply 204, such as a rechargeable or replaceable battery. The internalcomponents are provided in a housing 201 with provision for the antenna176 and physical interface 179.

The processor 202 enables the ambulatory repeater 123 to control theauthentication and secure transfer of both non-sensitive and sensitiveinformation between the IMD 103, one or more external sensors (notshown), and one or more of the base repeater 124, server 125, andprogrammer 126. The processor 202 also operates the ambulatory repeater123 based on functionality embodied in an analysis module 207, schedulemodule 208 and overwrite module 209. The analysis module 207 controlsthe translation, interpretation and display of patient healthinformation. The schedule module 208 controls the periodic interfacingof the ambulatory repeater 123 to the IMD 103 and external dataprocessing device. The overwrite module 209 controls thepatient-initiated interrogation. Other control modules are possible.

The communications module 205 includes an IMD telemetry module 210 andexternal data processing device (EDPD) telemetry module 211 forrespectively interfacing to the IMD 103 and external data processingdevice, such as the base repeater 124, server 125, and programmer 126.Preferably, the ambulatory repeater 123 interfaces to the IMD 103 andexternal sensors through inductive RF telemetry, Bluetooth, or otherform of secure wireless interface, while the ambulatory repeater 123interfaces to external data processing device preferably through RFtelemetry or via cellular network or other form of wireless interface.The authentication module 206 is used to securely authenticate andencrypt and decrypt sensitive information using a retrievedcryptographic key 212. The memory 203 includes a memory store, in whichthe physiological and parametric data retrieved from the IMD 103 aretransiently stored pending for transfer to the external data processingdevice and, in a further embodiment, download to the IMD 103. Thephysical interface 213 controls the direct physical connecting of theambulatory repeater 123 to an external data processing device orsupplemental accessory, such as a recharging “doc” or other similardevice. The optional integrated sensor 214 directly monitors patienthealth information, such as patient activity level. Lastly, the alarm215 provides a physical feedback alert to the patient, such as through avisual, tactual or audible warning, for example, flashing light,vibration, or alarm tone, respectively. Other internal components arepossible, including a physical non-wireless interface and removablememory components.

Ambulatory Repeater Method Overview

FIG. 7 is a flow diagram showing a method 220 for providing automatedpatient care using an ambulatory repeater 123, in accordance with oneembodiment. The purpose of this method is to periodically activate andsecurely exchange information with the IMD 103, one or more sensors 138,and an external data processing device that includes one or more of abase repeater 124, server 125, and programmer 126. The method 220 isdescribed as a sequence of process operations or steps, which can beexecuted, for instance, by an ambulatory repeater 123.

The method begins by obtaining the cryptographic key 122 (block 221), asfurther described below with reference to FIG. 8. The method theniteratively processes data exchange sessions (blocks 222-226) asfollows. First, the ambulatory repeater 123 is activated (block 223),which includes securely interrogating the IMD 103, as further describedbelow with reference to FIG. 9. Next, the ambulatory repeater 123performs a data exchange session with one or more of the external dataprocessing devices, including the base repeater 124, server 125, andprogrammer 126, as further described below with reference to FIG. 10.Following completion of the data exchange session, the ambulatoryrepeater 123 returns to a stand-by mode (block 225). Processingcontinues (block 226) while the ambulatory repeater 123 remains in apowered-on state.

Obtaining a Cryptographic Key

FIG. 8 is a flow diagram showing a routine 240 for obtaining acryptographic key 122 for use in the method 220 of FIG. 7. The purposeof this routine is to securely receive the cryptographic key uniquelyassigned to the IMD 103 into the ambulatory repeater 123.

Initially, the cryptographic key 122 is optionally generated (block241). Depending upon the system, the cryptographic key 122 could begenerated dynamically by the base repeater 124 or programmer 126 forsubsequent download to the IMD 103 using short range telemetry followingimplantation. Similarly, the cryptographic key 122 could be generatedduring the manufacturing process and persistently stored in the IMD 103prior to implantation. Alternatively, the cryptographic key 122 could bedynamically generated by the IMD 103.

Next, a secure connection is established with the source of thecryptographic key 122 (block 242). The form of the secure connection isdependent upon the type of key source. For instance, if the key sourceis the IMD 103, the secure connection could be established throughinductive or secure RF telemetric link via the base repeater 124 orprogrammer 126. If the key source is the base repeater 124, a secureconnection could be established through the dedicated hardwiredconnection.

Finally, the cryptographic key 122 is authenticated and obtained (block243) by storing the cryptographic key 122 into the authentication module206.

Ambulatory Repeater Activation

FIG. 9 is a flow diagram showing a routine 260 for activating anambulatory repeater 123 for use in the method 220 of FIG. 7. The purposeof the routine is to activate the ambulatory repeater 123 prior tointerrogating the sensors 138 and IMD 103.

The ambulatory repeater 123 can be activated as scheduled (block 261) orthrough manual action directly or indirectly by the patient (block 262)or remotely, such as by the server 125 (block 265).

Manual activation typically involves either a direct patient-initiatedinterrogation (block 263), such as operating a manual override control,or indirect action, such as removing the ambulatory repeater 123 from a“docking” cradle (block 264). Similarly, remote activation involveseither health-based data transfer triggers (block 266) or system-baseddata transfer triggers (block 267). A health-based data transfer istriggered when a prescribed or defined health status or alert conditionis detected. A system-based data transfer trigger occurs typically dueto a device-specific circumstance, such as data storage nearing maximumcapacity. Other forms of manual and remote ambulatory repeateractivations are possible. Upon activation, the sensors 138 and IMD 103are interrogated (blocks 268 and 269), as further described below withreference to FIG. 11.

Secure Data Exchange

FIG. 10 is a flow diagram showing a routine 280 for performing a securedata exchange for use in the method 220 of FIG. 7. The purpose of thisroutine is to exchange data between the ambulatory repeater 123 and oneor more external data processing device, such as the base repeater 124,server 125, and programmer 126.

Initially, any sensitive information 127 is encrypted (block 281) using,for instance, the cryptographic key 122 that is uniquely assigned to theIMD 103, or other cryptographic key (not shown) upon which theambulatory repeater 123 and external data processing device havepreviously agreed. A secure connection is opened with the external dataprocessing device (block 282) and the sensitive information is exchanged(block 283). The connection is “secure” in that the sensitiveinformation is only exchanged in an encrypted or similar form protectingthe sensitive information from compromise and interception byunauthorized parties. In the described embodiment, the secure connectionis served through a Web-based data communications infrastructure, suchas Web-Sphere software, licensed by IBM Corporation, Armonk, N.Y. Othertypes of data communications infrastructures can be used. Upon thecompetition of the exchange of sensitive information, the secureconnection with external data processing device is closed (block 284)and a non-secure connection is open (block 285). Similarly,non-sensitive information is exchanged (block 286) and the non-secureconnection is closed (block 287). The non-sensitive information can besent in parallel to the sensitive information and can also be sent overthe secure connection. However, the sensitive information cannot be sentover the non-secure connection.

IMD Interrogation

FIG. 11 is a flow diagram showing a routine 300 for interrogating an IMD103 for use in the method 220 of FIG. 7. The purpose of this routine isto retrieve encrypted sensitive information 128, including any PHI, fromthe IMD 103 and to decrypt the encrypted sensitive information 128 usingthe cryptographic key 122 uniquely assigned to the IMD 103.

Initially, the ambulatory repeater 123 authenticates with the IMD 103(block 301). A connection is established between the IMD 103 and theambulatory repeater 123 (block 302) via an RF connection. Encryptedsensitive information 127, including any PHI, is retrieved from the IMD103 (block 303) and the connection between the IMD 103 and theambulatory repeater 123 is closed (block 304). The encrypted sensitiveinformation 128 is then decrypted using the cryptographic key 122 (block305).

While the invention has been particularly shown and described asreferenced to the embodiments thereof, those skilled in the art willunderstand that the foregoing and other changes in form and detail maybe made therein without departing from the spirit and scope of theinvention.

1. An external data processing device to interface with an ambulatoryrepeater, comprising: an ambulatory repeater interface in far fieldtelemetric communication with an ambulatory repeater; and a processorinterconnected to the ambulatory repeater interface, comprising: asecure connection module over which sensitive information preencryptedprior to implant under a cryptographic key uniquely assigned to animplantable medical device is received from the ambulatory repeater; anda non-secure connection module over which physiological measuresretrieved from the implantable medical device are received from theambulatory repeater.
 2. An external data processing device according toclaim 1, further comprising one of: a dedicated monitoring modulematched to the implantable medical device; a database storing thephysiological measures, the processor further comprising a processingmodule operative on the physiological measures; and a clinicalinterrogation interface to a plurality of implantable medical devices.3. An external data processing device according to claim 1, wherein theprocessor further comprises: a remote activation module issuing a datatransfer trigger over the ambulatory repeater interface to theambulatory repeater.
 4. An external data processing device according toclaim 3, wherein the data transfer trigger comprises a system-based datatransfer trigger occurring in response to a device-specificcircumstance.
 5. An external data processing device according to claim3, wherein the data transfer trigger comprises a health-based datatransfer trigger occurring in response to at least one of a detectedprescribed health status and a detected alert condition.
 6. An externaldata processing device according to claim 1, further comprising: aschedule of interrogations of the implantable medical device by theambulatory repeater, wherein the processor further comprises an uploadmodule to upload the schedule to the ambulatory repeater.
 7. An externaldata processing device according to claim 1, wherein the far fieldtelemetry is selected from at least one of radio frequency telemetry andcellular telemetry.
 8. An external data processing device according toclaim 1, wherein the physiological measures comprises at least one ofphysiological and behavioral data.
 9. A method for providing an externaldata processing device to interface with an ambulatory repeater,comprising: interfacing with an ambulatory repeater through far fieldtelemetric communication; securely receiving sensitive informationpreencrypted prior to implant under a cryptographic key uniquelyassigned to an implantable medical device via the ambulatory repeater;and non-securely receiving physiological measures retrieved from theimplantable medical device via the ambulatory repeater.
 10. A methodaccording to claim 9, further comprising one of: providing a dedicatedmonitoring module matched to the implantable medical device; storing thephysiological measures, the processor further comprising a processingmodule operative on the physiological measures; and providing a clinicalinterrogation interface to a plurality of implantable medical devices.11. A method according to claim 9, further comprising: issuing a datatransfer trigger over the ambulatory repeater interface to theambulatory repeater.
 12. A method according to claim 11, wherein thedata transfer trigger comprises a system-based data transfer triggeroccurring in response to a device-specific circumstance.
 13. A methodaccording to claim 11, wherein the data transfer trigger comprises ahealth-based data transfer trigger occurring in response to at least oneof a detected prescribed health status and a detected alert condition.14. A method according to claim 9, further comprising: schedulinginterrogations of the implantable medical device by the ambulatoryrepeater; and uploading the schedule to the ambulatory repeater.
 15. Amethod according to claim 9, wherein the far field telemetry is selectedfrom at least one of radio frequency telemetry and cellular telemetry.16. A method according to claim 9, wherein the physiological measurescomprises at least one of physiological and behavioral data.
 17. Anambulatory repeater apparatus for providing automated patient care,comprising: providing a sensor to directly monitor a patient and torecord physiological measures on an ad hoc basis; an implantable medicaldevice comprising: a sensor interface; physiological measuresperiodically retrieved over the sensor interface; and stored sensitiveinformation preencrypted prior to implant under a cryptographic keyuniquely assigned; and an ambulatory repeater, comprising: anauthentication module to authenticate authorization from an externaldata processing device to interrogate the implantable medical device; anauthentication module to securely obtain the cryptographic key; atelemetry transceiver to interface to the implantable medical devicethrough wireless telemetry upon securing authorization and to obtain thesensitive information and physiological measures; and a communicationsmodule to decrypt the sensitive information using the cryptographic keyand to facilitate exchange of the sensitive information and thephysiological measures with an external data processing device.
 18. Anambulatory repeater apparatus according to claim 17, wherein the sensoris one of external to and integrated directly into the ambulatoryrepeater.
 19. An ambulatory repeater apparatus according to claim 17,wherein the sensor interface operates over at least one of inductivetelemetry, radio frequency telemetry, and Bluetooth telemetry.
 20. Anambulatory repeater apparatus according to claim 17, wherein the sensoris selected from at least one of weight scale, blood pressure monitor,electrocardiograph, and Holter monitor.
 21. A method for providingautomated patient care using an ambulatory repeater apparatus,comprising: directly monitoring a patient via a sensor and recordingphysiological measures on an ad hoc basis; providing an implantablemedical device, comprising: interfacing to the sensor and periodicallyretrieving the physiological measures; and storing sensitive informationpreencrypted prior to implant under a cryptographic key uniquelyassigned; and providing an ambulatory repeater, comprising:authenticating authorization from an external data processing device tointerrogate the implantable medical device; securely obtaining thecryptographic key; interfacing to the implantable medical device throughwireless telemetry upon securing the authorization; obtaining thesensitive information and the physiological measures from theimplantable medical device; decrypting the sensitive information usingthe cryptographic key; and exchanging the secure information and thephysiological measures with an external data processing device.
 22. Amethod according to claim 21, wherein the sensor is one of external toand integrated directly into the ambulatory repeater.
 23. A methodaccording to claim 21, wherein the interfacing of the implantablemedical device and the sensor operates over at least one of inductivetelemetry, radio frequency telemetry, and Bluetooth telemetry.
 24. Amethod according to claim 21, wherein the sensor is selected from atleast one of weight scale, blood pressure monitor, electrocardiograph,and Holter monitor.